| शीर्षक | https://github.com/actiontech https://github.com/actiontech/sqle ≤4.2511.0 Authentication Bypass by Primary Weakness |
|---|
| विवरण | The SQLE file contains a hard-coded JWT authentication key and valid JWT credentials. An attacker could exploit this vulnerability to bypass the system's authentication credential mechanism and gain full system privileges. Regarding the default JWT key, once the system is deployed, the JWT encryption key will be []byte("secret"). Furthermore, the codebase also hard-coded a super administrator's credential that would not expire until 2073, posing a significant security risk to the system. |
|---|
| स्रोत | ⚠️ https://github.com/actiontech/sqle/issues/3186 |
|---|
| उपयोगकर्ता | 28Hus (UID 92415) |
|---|
| सबमिशन | 09/12/2025 03:59 PM (10 महीनों पहले) |
|---|
| संयम | 27/12/2025 12:07 AM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 338478 [actiontech sqle तक 4.2511.0 JWT Secret sqle/utils/jwt.go JWTSecretKey कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|